2903789faf28360faa6e0fdfae030bd11aa5eaee38f39acc844e7e718609bdea

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa4a9a22f2096bec2c3d1b029f015462_JaffaCakes118.pdf
Size

44KB
MD5

fa4a9a22f2096bec2c3d1b029f015462
SHA1

96637c4034708e165ff1643bbe3b3395338be012
SHA256

2903789faf28360faa6e0fdfae030bd11aa5eaee38f39acc844e7e718609bdea
SHA512

45ab41ddb31110f1af5939b7a1524755dc9a05226244a2c405635e9d9bf1bc4c956c68f84396b17c5ba13f0c1fd0b9c73edb70c9d1abeddd35241513e463cbbc
SSDEEP

768:HXuMZmwgCLWarSFuE5HpuJfVC86U2tLOLXot1xfyXD0u2aL/uzNDrXkUkzbWsEan:HXFZmGWSu8ZVC86U2tiLXot1xaz0u2ad

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe
2888	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa4a9a22f2096bec2c3d1b029f015462_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2896f5e0374014709fcbaf0de25e4993

SHA1
934b509b57f78d59fdcf3452a1a76881151b7c73

SHA256
686552c60fecda74bcdb097049da82627ddec2551d313e7f6c8bc53e7edc162e

SHA512
3bc3e2c9c62fa49b6ada6a4c00e786f7489f22fe1cdf8d6faba54afb791f15191e088b8c9acc64d2642ea2d23cdb497e5f22e4a1ba0703a8a432483ff467e828

Download Submit